GOFFEE continues to attack organizations in Russia

GOFFEE, a tracked APT, executed targeted spear‑phishing and removable‑media campaigns against Russian media, telecoms, construction, government and energy organizations (observed Jul–Dec 2024), deploying patched explorer.exe implants and multiple tools including a PowerShell downloader (PowerModul), a PowerShell Mythic agent (PowerTaskel), a binary Mythic agent, FlashFileGrabber (data-stealer), and a USB Worm; the report provides technical TTPs for initial access, persistence, lateral movement (PsExec/WinRM), and includes IoCs (file hashes, C2 IPs) and detailed payload behavior.